Is this website fake?

Check the address from the right: the part just before the ending is the real owner, so in paypal.com.verify-login.xyz the owner is verify-login.xyz. Then look for a typo or number swapped for a letter, a domain registered only days ago, pressure to act now, and payment by gift card, crypto or bank transfer. Website Check does the address and records checks for you and can open the page so you never have to.

No. It never says a site is safe, and it does not call a business a scam. It tells you what it found: whether the address copies a well-known brand, what public records show and what the page asks for. Finding no red flags is not proof of safety.

No. HTTPS only means the connection is encrypted. Fake sites use it too, so it says nothing about who runs the site.

A reading service opens the site's home page (or a short campaign-code link such as /vAsFCw) on its own servers, once plainly and once as a phone visitor arriving from a social media ad, and returns a screenshot and the page's text. If the two visits show different pages, we flag it as cloaking. An AI (Google Gemini) then describes the page in plain words: what it is and what it asks you to do or give. Our own rules separately check for password, card and one-time-code fields, how it wants to be paid, who it says it is and where it redirects. You never open the site yourself, and nothing from your visit is kept. The AI can make mistakes and never says whether a site is safe.

Yes. Under the main check there is a bulk box: upload a CSV (one address per row, or a column headed url, domain or website) or paste a list of up to 25 addresses. Each one gets the address check, the public records and a scam-pattern score with a report, and you can download the results as a CSV. Pages are not opened in bulk, so the scores rest on the address and public records; use the single check for a screenshot and the AI summary.

A report for analysts, moderators and anyone building a case. It scores the address against a published list of scam indicators (throwaway endings, brand-new domains, WhatsApp rotators, payment cashiers, cloaking, many ad-tracking IDs, known scam page kits), names the likely scam family, lists each indicator with its evidence, first and last seen time and caveats, and shows other addresses that people have checked here which share the same registration second, ad-tracking ID, dedicated server or page kit. It only looks things up: nothing is submitted to any scanner, and no forms, payments, QR codes, app downloads or messages are involved. The rating is a pattern rating by rules, not a finding by a person or a court, and new evidence can raise it but never lowers it.

Yes, once the instant address check is done the AI check starts by itself and the page is opened by the reading service, not by your device or our server. The address check and public records are looked up without opening the site. Only the home page (or a short campaign-code link such as /vAsFCw) is ever opened, never other pages or anything after a ? mark.

Regulators publish lists of unauthorised or imposter firms and websites to warn the public. When an address you check appears on one we read, we show which regulator lists it, the entity named, and a link to the list. A listing is a public warning, not a court finding, and a list that does not name a site is not a clean bill of health.

Call your bank or card issuer straight away, change the password anywhere you reused it, and report it to the police. Our Bank Fraud Help and cyber agencies directories list the official numbers and portals by country.